ssl - 为什么 tomcat 在加载自签名 SSL 证书时遇到问题？

Question

我在让 tomcat 加载自签名证书时遇到问题。我按照 this 上的说明进行操作网站信，修改了我在 server.xml 文件中的连接器，将安全约束添加到我的 tomcat.conf 文件中。以下是我的 catalina.out 的输出:

Using CATALINA_BASE:   /usr/share/tomcat5
Using CATALINA_HOME:   /usr/share/tomcat5
Using CATALINA_TMPDIR: /usr/share/tomcat5/temp
Using JRE_HOME:       /usr/lib/jvm/jre
Created MBeanServer with ID: -hnoxxr:gj0olj3z.0:s15425714.domainepardefaut.fr:1
17-Jan-11 2:13:25 AM org.apache.catalina.core.AprLifecycleListener lifecycleEvent
INFO: The Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: /usr/lib64/gcj-4.1.2
17-Jan-11 2:13:25 AM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8081
17-Jan-11 2:13:26 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore
java.security.KeyStoreException: JKS
   at java.security.KeyStore.getInstance(libgcj.so.7rh)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.coyote.http11.Http11BaseProtocol init
SEVERE: Error initializing endpoint
java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load
SEVERE: Catalina.start
LifecycleException:  Protocol handler initialization failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 744 ms
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/5.5.23
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardHost start
INFO: XML validation disabled
17-Jan-11 2:13:26 AM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive myapp.war
17-Jan-11 2:13:26 AM org.apache.catalina.loader.WebappClassLoader validateJarFile
INFO: validateJarFile(/usr/share/tomcat5/webapps/myapp/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax).
log4j:WARN Please initialize the log4j system properly.
17-Jan-11 2:13:27 AM org.apache.catalina.startup.TldConfig lifecycleEvent
SEVERE: Error processing TLD files for context path /myapp
javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context /myapp
   at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployWAR(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployWARs(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:29 AM org.apache.catalina.loader.WebappClassLoader validateJarFile
INFO: validateJarFile(/usr/share/tomcat5/webapps/ROOT/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax).
log4j:WARN Please initialize the log4j system properly.
17-Jan-11 2:13:29 AM org.apache.catalina.startup.TldConfig lifecycleEvent
SEVERE: Error processing TLD files for context path 
javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context 
   at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployDirectory(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployDirectories(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start
INFO: Starting Coyote HTTP/1.1 on http-8081
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering Hosts
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering WebModule Contexts
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering Servlets
17-Jan-11 2:13:31 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore
java.security.KeyStoreException: JKS
   at java.security.KeyStore.getInstance(libgcj.so.7rh)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start
SEVERE: Error starting endpoint
java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start: 
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 5535 ms

我在启动tomcat后做了一个端口扫描。标准端口与 8005 一起启动，但 SSL 端口不存在。我在某处错过了一步吗？

Answer 1

我猜你正在使用 gcj 编译的 tomcat 5.5，在一些带有 java-1.5.0-gcj 的 linux 发行版(debian 或 ubuntu？)上。您可以在此处找到一些主题帮助: https://bugzilla.redhat.com/show_bug.cgi?id=238613

检查异常消息中指示的 keystore 是否实际存在，以及它是否为 JKS 格式。或者将 server.xml 中的 keystoreFile 属性指向 JVM 提供的 cacerts 文件(如果我的猜测是正确的，应该是/usr/lib/jvm/java-1.5.0-gcj-4.3-1.5.0.0/jre/lib/security/cacerts )并在那里导入您的自签名证书。Stock cacerts 文件有默认密码 = changeit

但是我建议您使用 sun-jvm 或来自您的发行版的 openjdk-1.6.0，以避免很多麻烦，特别是如果它是您的第一个 ssl 部署之一。

编辑:让我在这里附加我的工作配置:

<Connector port="8443" maxHttpHeaderSize="8192"       maxThreads="150" minSpareThreads="25" maxSpareThreads="75"       enableLookups="false" disableUploadTimeout="true"       acceptCount="100" scheme="https" secure="true"       clientAuth="false" sslProtocol="TLS"        keystoreFile="/etc/pki/java/cacerts"        keystorePass="changeit" keystoreType="JKS"       keyAlias="tomcat"/>

在/etc/pki/java/cacerts keystore 中，我生成了一个 key 对:

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /etc/pki/java/cacerts

注意:如果您没有在 server.xml 中指定 key 别名，则使用在 keystore 中找到的第一个 key 对。

重要提示: keystore 密码必须与私钥密码相同!